Question 1

How does a jurisdiction's FATF grey list status change affect my compliance obligations?

Accepted Answer

The FATF grey list (Jurisdictions Under Increased Monitoring) is reviewed at each FATF plenary, so a jurisdiction can be added or removed multiple times in a year following legislative reform and changes to its AML/CTF supervisory framework. When a jurisdiction your customer is connected to is added to the grey list, correspondent banks typically apply enhanced scrutiny to transactions linked to it - and your own risk-based approach should treat that connection as an elevated risk factor. A jurisdiction's removal from the list reduces that external pressure, but it does not reduce your obligations under Australia's AML/CTF regime. Customer Due Diligence, Enhanced Due Diligence, the risk-based approach, and your AML/CTF Program requirements remain fully in force. Your AML/CTF Program should be updated to reflect each jurisdiction's current FATF status. KYCopilot's country risk module updates FATF status in real time across all 200+ covered jurisdictions - so country risk scores always reflect the current listing position, not a static snapshot.

Question 2

Which countries are on the FATF grey list and what must I do when a client is connected to one?

Accepted Answer

The FATF grey list - formally Jurisdictions Under Increased Monitoring - identifies countries with strategic deficiencies in their AML/CTF frameworks. The list is reviewed and updated at each FATF plenary meeting, typically held in February, June, and October each year. When a client is connected to a grey-listed jurisdiction - through nationality, place of business, transaction flows, or corporate structure - the risk-based approach under Australia's AML/CTF regime requires you to treat this as an elevated risk factor that will typically trigger Enhanced Due Diligence. The connection and your risk rationale must be documented in your AML/CTF Program. Because the list changes regularly, institutions relying on static lists quickly fall out of date. KYCopilot's country risk module monitors FATF grey and black list status in real time across all covered jurisdictions, so changes are automatically reflected in your client risk assessments.

Question 3

How do I assess geographic risk for a client with offshore interests or cross-border transactions?

Accepted Answer

Geographic risk assessment requires evaluating the risk profile of every jurisdiction to which a client is exposed - not just their primary country of incorporation or residence. Under the risk-based approach of Australia's AML/CTF regime, relevant geographic connections include the client's nationality, country of residence, location of business operations, jurisdictions of transaction counterparties, and the domicile of any associated entities. Each jurisdiction should be assessed across multiple risk dimensions: AML/CTF framework maturity, FATF status, sanctions exposure, governance and rule of law quality, geopolitical stability, and sovereign risk. A client with business interests in a jurisdiction with weak AML controls but no formal sanctions designation still presents elevated geographic risk that must be reflected in their risk rating. KYCopilot's country risk module scores all six dimensions across 200+ jurisdictions and integrates this automatically into every EDD report.

Question 4

What is the difference between country risk and sanctions risk in a compliance context?

Accepted Answer

Sanctions risk and country risk are related but distinct assessments. Sanctions risk is binary - a jurisdiction is either subject to a formal sanctions programme (OFAC, UN, EU, DFAT) or it is not, and transacting with a sanctioned jurisdiction carries clear legal consequences. Country risk is broader - it encompasses the overall AML/CTF, governance, geopolitical, and financial crime environment of a jurisdiction regardless of whether formal sanctions apply. A country can present high compliance risk through weak AML laws, high corruption, or poor rule of law without being formally sanctioned - and that elevated country risk still informs your institution's risk rating of clients connected to that jurisdiction. KYCopilot assesses both: real-time sanctions checks across 12+ lists and multi-dimensional country risk scoring across six separate risk pillars.

Real-time Country Risk Intelligence. 200+ Jurisdictions.

Colour-coded risk at a glance

Comprehensive risk across every dimension

AML/CTF Risk

Sanctions Exposure

Governance & Rule of Law

ESG & Sustainability

Sovereign Risk

Geopolitical Risk

200+ countries & territories

Built into every EDD report

Frequently asked country risk questions

Start your country risk assessment

EDD Reports

I2G™ Intelligence

COMFORT Score™